Skip to main content

Cloud Monitoring Should Monitor Dropped Packets Count For

More Info:​

Ensure Cloud Monitoring monitors dropped packets count for firewall.

Risk Level​

Medium

Address​

Performance Efficiency, Reliability, Security

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of not monitoring dropped packets count for firewall in GCP using GCP console, please follow the below steps:

  1. Login to the GCP console.
  2. Select the project in which the firewall is configured.
  3. Navigate to the VPC Network page from the left-hand side menu.
  4. Click on the Firewall rules tab.
  5. Click on the Edit button (pencil icon) next to the firewall rule you want to modify.
  6. Scroll down to the Logs section and select the checkbox for "Log dropped packets."
  7. Click on the Save button to save the changes.

By enabling logging for dropped packets, you can monitor and analyze the traffic that is being blocked by your firewall. This can help you identify potential security threats and take appropriate actions to mitigate them.

Using CLI

To remediate the misconfiguration of dropped packets count for firewall in GCP using GCP CLI, follow the below steps:

  1. Open the GCP Cloud Shell.

  2. Run the following command to list all the firewall rules in your project:

    gcloud compute firewall-rules list

  3. Identify the firewall rule that needs to be modified.

  4. Run the following command to update the firewall rule and enable logging for dropped packets:

    gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --enable-logging --log-config="metadata:include-all-scopes=true"

    Replace [FIREWALL_RULE_NAME] with the name of the firewall rule that needs to be modified.

  5. Verify that the logging is enabled for the firewall rule by running the following command:

    gcloud compute firewall-rules describe [FIREWALL_RULE_NAME]

    Replace [FIREWALL_RULE_NAME] with the name of the firewall rule that was modified.

  6. Check the logs in the Logging section of the GCP Console to ensure that the dropped packets count is being monitored.

By following these steps, you can remediate the misconfiguration of dropped packets count for firewall in GCP using GCP CLI.

Using Python

To remediate the misconfiguration of not monitoring the dropped packet count for Firewall in GCP using Python, follow the below steps:

  1. Install the required libraries:

    pip install google-cloud-monitoring google-auth google-auth-oauthlib google-auth-httplib2

  2. Authenticate with GCP:

    from google.oauth2 import service_account
    credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_file>')

  3. Import the necessary libraries:

    from google.cloud import monitoring_v3
    from google.api_core.exceptions import AlreadyExists

  4. Set the project ID and the client:

    project_id = '<your_project_id>'
    client = monitoring_v3.MetricServiceClient(credentials=credentials)

  5. Define the metric descriptor:

    descriptor = monitoring_v3.types.MetricDescriptor()
    descriptor.type = 'custom.googleapis.com/firewall/dropped_packets'
    descriptor.metric_kind = monitoring_v3.enums.MetricDescriptor.MetricKind.GAUGE
    descriptor.value_type = monitoring_v3.enums.MetricDescriptor.ValueType.INT64
    descriptor.description = 'Dropped Packets Count for Firewall'
    descriptor.unit = '1'

  6. Create the metric descriptor:

    try:
        client.create_metric_descriptor(project_id, descriptor)
    except AlreadyExists:
        pass

  7. Define the time series data:

    series = monitoring_v3.types.TimeSeries()
    series.metric.type = 'custom.googleapis.com/firewall/dropped_packets'
    series.resource.type = 'global'
    series.resource.labels['project_id'] = project_id
    series.points.add(value=10)

  8. Write the time series data:

    client.create_time_series(project_id, [series])

With these steps, the misconfiguration of not monitoring the dropped packet count for Firewall in GCP can be remediated using Python.

Using Terraform
resource "google_monitoring_alert_policy" "firewall_dropped_packets" {
  project      = "GCP_PROJECT_ID"         # Replace with your project ID
  display_name = "Firewall dropped packets alert"

  combiner = "OR"

  conditions {
    display_name = "Firewall dropped packets count too high"

    condition_threshold {
      filter = "metric.type=\"compute.googleapis.com/firewall/dropped_packets_count\""

      comparison      = "COMPARISON_GT"
      threshold_value = DROPPED_PACKETS_THRESHOLD   # Replace with a numeric threshold (e.g., 0 or 100)

      duration = "60s"   # How long the condition must hold before alerting

      trigger {
        count = 1
      }

      aggregations {
        alignment_period     = "60s"
        per_series_aligner   = "ALIGN_DELTA"
        cross_series_reducer = "REDUCE_SUM"
        group_by_fields      = ["metric.label.\"firewall_name\""]
      }
    }
  }

  notification_channels = [
    "NOTIFICATION_CHANNEL_ID_1",          # Replace with existing google_monitoring_notification_channel IDs
    "NOTIFICATION_CHANNEL_ID_2"
  ]

  user_labels = {
    environment = "ENVIRONMENT_TAG"      # e.g., "prod"
  }
}

This does not force replacement of other resources; only this alert policy will be created/updated.

Verification with terraform plan should show a new google_monitoring_alert_policy.firewall_dropped_packets to be created (or updated) with metric.type = "compute.googleapis.com/firewall/dropped_packets_count" and the configured threshold_value.

Additional Reading:​